Re: [IPsec] Fw: Preshared key authentication in IKEv2

[Tero Kivinen <kivinen at iki.fi>]

Valery Smyslov writes:
> Hi Paul and Tero,
> 
> thank you for your answers.
> 
> > > The PRF (or set of PRFs) is known by the receiving party. If the two
> > > parties always only use one PRF, it is known. The padding is not a
> > > universal solution for the reasons you give, but it works in the
> > > common case of peers who know each other's crypto choices.
> >
> > As Paul said recipient knows which algorithms it support, and it can
> 
> Sometimes it doesn't. I refer to implementations with pluggable
> crypto, when crypto providers are separated from IKE implementation
> and can be added/removed later.

Then you need to store the original shared key not the hashed version
of it.
-- 
kivinen at iki.fi